Merge ~enr0n/ubuntu/+source/openssh:generator-v3 into ubuntu/+source/openssh:ubuntu/devel

[Nick Rosbrook]

Add sshd-socket-generator, which generates ListenStream= overrides by parsing sshd_config, rather than writing the override once on package upgrade.

[Steve Langasek (vorlon)]

review: Needs Fixing

[Nick Rosbrook (enr0n)]

Thanks for reviewing, Steve. Replied to inline comments.

[Nick Rosbrook (enr0n)]

And pushed new changes.

[Steve Langasek (vorlon)]

Thanks, you've addressed the fails-to-start-on-boot issue brilliantly, I didn't realize there was a solution for this in systemd unit syntax (and wonder whether FreeBind=yes shouldn't be the default?)

I can't think of any other blockers for this to be an unconditional switch to socket activation as multiple listen addresses was the only case where we didn't already do the upgrade automatically.

I'm going to tag in Robie from server for an additional review since he had good feedback on the first iteration of this and would be a good second set of eyes.

I have not done an in-depth review of the C code. Do you want that from me here?

[Nick Rosbrook (enr0n)]

> I have not done an in-depth review of the C code. Do you want that from me
> here?

The more review the better, but I understand your time is valuable :D

[Steve Langasek (vorlon)]

Marking approved, others in the team can also review C code if you need it (and I know Debian upstream will give you a solid review when you forward this)

review: Approve

diff --git a/debian/README.Debian b/debian/README.Debian
index 8067852..70c588f 100644
--- a/debian/README.Debian
+++ b/debian/README.Debian
@@ -186,27 +186,26 @@ Socket-based activation with systemd
 
 By default, socket-based activation is used on systems that use systemd.
 
-The provided ssh.socket unit file sets ListenStream=22.  If you need to have
-it listen on a different address or port, then you will need to do this as
-follows (modifying ListenStream to match your requirements):
-
-  mkdir -p /etc/systemd/system/ssh.socket.d
-  cat >/etc/systemd/system/ssh.socket.d/listen.conf <<EOF
-  [Socket]
-  ListenStream=2222
-  EOF
+The provided ssh.socket unit file sets ListenStream=22. A systemd generator,
+sshd-socket-generator, parses the sshd configuration and, if non-default
+ListenAddress(s) or Port(s) are configured, generates corresponding
+ListenStream= lines in a drop-in configration file for ssh.socket. To change
+the port or address ssh.socket is listening on, edit /etc/ssh/sshd_config (or
+add a drop-in file to /etc/ssh/sshd_config.d/) as usual and then run:
+
   systemctl daemon-reload
   systemctl restart ssh.socket
 
 See systemd.socket(5) for details.
 
 If you do not want to use socket activation for ssh on your system, you
-can disable socket activation by running:
+can disable socket activation by masking the generator and re-enabling
+ssh.service:
 
-  systemctl disable --now ssh.socket
-  rm -f /etc/systemd/system/ssh.service.d/00-socket.conf
-  rm -f /etc/systemd/system/ssh.socket.d/addresses.conf
+  mkdir -p /etc/systemd/system-generators/
+  ln -s /dev/null /etc/systemd/system-generators/sshd-socket-generator
   systemctl daemon-reload
+  systemctl disable --now ssh.socket
   systemctl enable --now ssh.service
 
 Terminating SSH sessions cleanly on shutdown/reboot with systemd
diff --git a/debian/changelog b/debian/changelog
index eaaedcc..68dc34f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,30 @@
+openssh (1:9.6p1-3ubuntu3) noble; urgency=medium
+
+  * Add sshd-socket-generator to generate ssh.socket drop-in configuration
+    instead of doing one-time generation on package upgrade:
+    - debian/control: Build-Depends: systemd-dev
+    - d/p/sshd-socket-generator.patch: add generator for socket activation
+    - debian/openssh-server.install: install sshd-socket-generator
+    - debian/openssh-server.postinst: handle migration to sshd-socket-generator
+    - d/t/sshd-socket-generator: add dep8 test for sshd-socket-generator
+    - ssh.socket: adjust unit for socket activation by default
+    - debian/README.Debian: update ssh.socket documentation
+    - debian/rules: explicitly enable LTO
+      The armhf build was not using LTO, which made sshd-socket-generator FTBFS.
+      This change ensures that all arches are using LTO.
+  * Drop the following changes related to previous ssh socket activation approach:
+    - debian/openssh-server.postrm: remove systemd drop-ins for
+      socket-activated sshd on purge
+    - debian/openssh-server.templates: include debconf prompt explaining
+      when migration cannot happen due to multiple ListenAddress values
+    - debian/openssh-server.postinst: handle migration of sshd_config options
+      to systemd socket options on upgrade.
+    - debian/patches/socket-activation-documentation.patch: Document in
+      sshd_config(5) that ListenAddress and Port no longer work.
+  * debian/openssh-server.ucf-md5sum: update for new Ubuntu delta
+
+ -- Nick Rosbrook <[e-mail]>  Wed, 21 Feb 2024 12:51:30 -0500
+
 openssh (1:9.6p1-3ubuntu2) noble; urgency=medium
 
   [ Marco Trevisan (Treviño) ]
diff --git a/debian/control b/debian/control
index e93b516..58e9a89 100644
--- a/debian/control
+++ b/debian/control
@@ -20,6 +20,7 @@ Build-Depends: debhelper (>= 13.1~),
                libwrap0-dev | libwrap-dev,
                pkg-config,
                zlib1g-dev,
+               systemd-dev,
 Standards-Version: 4.6.2
 Uploaders: Colin Watson <[e-mail]>,
            Matthew Vernon <[e-mail]>,
diff --git a/debian/openssh-server.install b/debian/openssh-server.install
index cf86dce..9942604 100755
--- a/debian/openssh-server.install
+++ b/debian/openssh-server.install
@@ -19,3 +19,5 @@ debian/systemd/ssh-session-cleanup usr/lib/openssh
 # dh_apport would be neater, but at the time of writing it isn't in unstable
 # yet.
 debian/openssh-server.apport => usr/share/apport/package-hooks/openssh-server.py
+
+usr/lib/systemd/system-generators/sshd-socket-generator
diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst
index cb9a301..251f11c 100644
--- a/debian/openssh-server.postinst
+++ b/debian/openssh-server.postinst
@@ -17,87 +17,6 @@ get_config_option() {
 	/usr/sbin/sshd -G | sed -n "s/^$option //Ip"
 }
 
-get_config_option_all() {
-	option="$1"
-	file="$2"
-
-	if [ -z "$file" ]; then
-		file=/etc/ssh/sshd_config
-	fi
-
-	[ -f "$file" ] || return 0
-	# ListenAddress and Port only take a single word argument so anything
-	# after this must be a comment
-	while read option2 value junk; do
-		case $option2 in
-			$option)
-				echo $value
-				;;
-			Include)
-				# globs
-				for f in $value; do
-					get_config_option_all "$option" "$f"
-				done
-				;;
-		esac
-	done < $file
-}
-
-hostnames_to_addresses() {
-	addresses="$1"
-	for address in $addresses; do
-		address_no_port="$(address_strip_port $address)"
-		if echo "$address_no_port" | grep -q '^[0-9a-f:]\+$\|^[0-9.]\+$'; then
-			numeric_addresses="$numeric_addresses $address"
-		else
-			new_addresses=$( (getent ahostsv4 $address_no_port;
-			                  getent ahostsv6 $address_no_port) \
-			   | awk '$1 ~ /^::ffff:/ || $2 != "STREAM" { next; }
-			          $1 ~ /:/ { print "[" $1 "]"; next; }
-			          { print $1 }' \
-			   | sort -u)
-			port="$(port_from_address $address)"
-			if [ -n "$port" ]; then
-				new_addresses="$(for addr in $new_addresses; do echo $addr:$port; done)"
-			fi
-			numeric_addresses="$numeric_addresses $new_addresses"
-		fi
-	done
-	echo "$numeric_addresses"
-}
-
-port_from_address() {
-        address="$1"
-        if echo $address | grep -q '^\[[0-9a-f:]*\]:'; then
-                # This is an IPv6 address with a port.
-                port="$(echo $address | awk -F':' '{print $NF}')"
-        elif echo $address | grep -q '^\[[0-9a-f:]*\]\+$\|^[0-9a-f:]\+$'; then
-                # This is an IPv6 address without a port.
-                port=""
-        else
-                # This is an IPv4 address or hostname, where the port
-                # may or may not be specified.
-                port="$(echo $address | awk -F':' '{print $2}')"
-        fi
-        echo "$port"
-}
-
-address_strip_port() {
-        address="$1"
-        if echo $address | grep -q '^\[[0-9a-f:]*\]\(:\|$\)'; then
-                # This is an IPv6 address in brackets, with or without a port.
-                address_no_port="$(echo $address | awk -F '[][]' '{print $2}')"
-        elif echo $address | grep -q '^[0-9a-f:]\+$'; then
-                # This is an IPv6 address with no brackets and no port.
-                address_no_port="$address"
-        else
-                # This is an IPv4 address or hostname, where the port
-                # may or may not be specified.
-                address_no_port="$(echo $address | awk -F':' '{print $1}')"
-        fi
-        echo "$address_no_port"
-}
-
 
 create_key() {
 	msg="$1"
@@ -211,102 +130,39 @@ if [ "$action" = configure ]; then
 	    # which we now move back into place.
 	    mv /etc/ssh/moduli.dpkg-bak /etc/ssh/moduli
 	fi
-	if dpkg --compare-versions "$2" lt-nl 1:9.0p1-1ubuntu8~
-	then
-		# migrate to systemd socket activation.
-		addresses=$(get_config_option_all ListenAddress)
-		addresses=$(hostnames_to_addresses "$addresses")
-		ports=$(get_config_option_all Port)
-		if [ -n "$addresses$ports" ]
-		then
-			override_dir=/etc/systemd/system/ssh.socket.d
-			mkdir -p "$override_dir"
-			echo '[Socket]' > "$override_dir"/addresses.conf.new
-			echo 'ListenStream=' >> "$override_dir"/addresses.conf.new
-		fi
-		if [ -n "$addresses" ]; then
-			[ -n "$ports" ] || ports=22
-			count=0
-			for address in $addresses; do
-				count=$((count+1))
-				port_from_address="$(port_from_address $address)"
-				if [ -z "$port_from_address" ]; then
-					for port in $ports; do
-						echo "ListenStream=$address:$port" \
-						     >> "$override_dir"/addresses.conf.new
-					done
-				else
-					echo "ListenStream=$address" \
-					     >> "$override_dir"/addresses.conf.new
-				fi
-			done
-			if [ $count -gt 1 ]; then
-				db_input critical openssh-server/listenstream-may-fail || true
-				db_go || true
-				rm -f "$override_dir"/addresses.conf.new
-				rmdir --ignore-fail-on-non-empty "$override_dir"
-				NO_SOCKET_MIGRATION=1
-			fi
-		elif [ -n "$ports" ]; then
-			for port in $ports; do
-				echo "ListenStream=$port" \
-				     >> "$override_dir"/addresses.conf.new
-			done
-		fi
-
-		if [ -z "$NO_SOCKET_MIGRATION" ] && [ -n "$addresses$ports" ]
-		then
-                    mv "$override_dir"/addresses.conf.new \
-                       "$override_dir"/addresses.conf
-		fi
-	fi
-	if dpkg --compare-versions "$2" lt 1:9.0p1-1ubuntu5~; then
-		if [ -z "$NO_SOCKET_MIGRATION" ]; then
-			override_dir=/etc/systemd/system/ssh.service.d
-			mkdir -p "$override_dir"
-			echo '[Unit]' > "$override_dir"/00-socket.conf
-			echo 'After=ssh.socket' >> "$override_dir"/00-socket.conf
-			echo 'Requires=ssh.socket' >> "$override_dir"/00-socket.conf
-
-			# deb-systemd-helper is inadequate for the task of
-			# changing policy for the units on upgrade
-			if [ -d /run/systemd/system ]; then
-				systemctl daemon-reload
-				systemctl disable ssh.service
-				systemctl unmask ssh.service
-				systemctl stop ssh.service
-				systemctl enable ssh.socket
-			fi
-		fi
-	fi
-
-        # Revert socket migration if we can determine the user hit
-        # LP: #1993478.
-        if dpkg --compare-versions "$2" lt-nl 1:9.0p1-1ubuntu7~ \
-           && [ -e /etc/systemd/system/ssh.socket.d/addresses.conf ] \
-           && [ -e /etc/systemd/system/ssh.service.d/00-socket.conf ] \
-           && [ -n "$NO_SOCKET_MIGRATION" ]; then
-                rm /etc/systemd/system/ssh.socket.d/addresses.conf
-                rmdir --ignore-fail-on-non-empty /etc/systemd/system/ssh.socket.d
-                rm /etc/systemd/system/ssh.service.d/00-socket.conf
-                rmdir --ignore-fail-on-non-empty /etc/systemd/system/ssh.service.d
-		if [ -d /run/systemd/system ]; then
-			systemctl daemon-reload
-			systemctl disable ssh.socket
-			systemctl stop ssh.socket
-			systemctl enable ssh.service
-		fi
+        if dpkg --compare-versions "$2" lt-nl 1:9.6p1-3ubuntu3~; then
+                # Remove old socket activation drop-in configurations, if they exist.
+                if [ -d /etc/systemd/system/ssh.socket.d ]; then
+                        rm -f /etc/systemd/system/ssh.socket.d/addresses.conf
+                        rmdir --ignore-fail-on-non-empty /etc/systemd/system/ssh.socket.d
+                fi
+                if [ -d /etc/systemd/system/ssh.service.d ]; then
+                        rm -f /etc/systemd/system/ssh.service.d/00-socket.conf
+                        rmdir --ignore-fail-on-non-empty /etc/systemd/system/ssh.service.d
+                fi
+                if [ -d /run/systemd/system ]; then
+                        # Make sure ssh.service is disabled.
+                        systemctl unmask ssh.service
+                        systemctl disable --now ssh.service > /dev/null 2>&1
+
+                        # sshd-socket-generator is invoked on daemon-reload.
+                        systemctl daemon-reload
+                        systemctl enable ssh.socket
+                fi
         fi
 fi
 
 #DEBHELPER#
 
 if [ -d /run/systemd/system ]; then
-	if deb-systemd-helper --quiet was-enabled ssh.socket; then
-		deb-systemd-invoke restart ssh.socket
-	elif deb-systemd-helper --quiet was-enabled ssh.service; then
-		deb-systemd-invoke restart ssh.service
-	fi
+        # sshd-socket-generator is invoked on daemon-reload.
+        systemctl daemon-reload
+
+        if deb-systemd-helper --quiet was-enabled ssh.socket; then
+                deb-systemd-invoke restart ssh.socket
+        elif deb-systemd-helper --quiet was-enabled ssh.service; then
+                deb-systemd-invoke restart ssh.service
+        fi
 fi
 
 db_stop
diff --git a/debian/openssh-server.postrm b/debian/openssh-server.postrm
index 46798dd..fbaeb17 100644
--- a/debian/openssh-server.postrm
+++ b/debian/openssh-server.postrm
@@ -23,10 +23,6 @@ case $1 in
 		if command -v ucfr >/dev/null 2>&1; then
 			ucfr --purge openssh-server /etc/ssh/sshd_config
 		fi
-		rm -f /etc/systemd/system/ssh.service.d/00-socket.conf
-		rm -f /etc/systemd/system/ssh.socket.d/addresses.conf
-		rmdir /etc/systemd/system/ssh.service.d || true
-		rmdir /etc/systemd/system/ssh.socket.d || true
 		rm -f /etc/ssh/sshd_not_to_be_run
 		[ ! -d /etc/ssh ] || rmdir --ignore-fail-on-non-empty /etc/ssh
 
diff --git a/debian/openssh-server.templates b/debian/openssh-server.templates
index 31f2935..e071fe3 100644
--- a/debian/openssh-server.templates
+++ b/debian/openssh-server.templates
@@ -21,15 +21,3 @@ Description: Allow password authentication?
  By default, the SSH server will allow authenticating using a password.
  You may want to change this if all users on this system authenticate using
  a stronger authentication method, such as public keys.
-
-Template: openssh-server/listenstream-may-fail
-Type: error
-_Description: Not migrating to socket activation
- This version of openssh-server uses socket-based activation by default.
- However, because you have more than one ListenAddress configured in
- sshd_config, it is impossible to determine at upgrade time if migrating
- you to socket-based activation would cause the starting of sshd at boot
- to be unreliable.
- .
- Because a failure to start ssh may make it impossible to admininister a
- system, you will not be migrated to socket-based activation at this time.
diff --git a/debian/openssh-server.ucf-md5sum b/debian/openssh-server.ucf-md5sum
index 9a8efb6..b2c0ac3 100644
--- a/debian/openssh-server.ucf-md5sum
+++ b/debian/openssh-server.ucf-md5sum
@@ -132,3 +132,9 @@ fac56840f6697a357368bb878dd8fb87
 d01da8c9de75176095712d4e37d5dcd5
 e4898846045f33b8d99d3263d6f6fd81
 ec46dc59ba9c9e9458add405264fcedd
+
+# From 1:9.6p1-3ubuntu3
+b8e751f62cf86a18bc30cdaae494b03f
+b89c8626d43128cdb233536439e00566
+5f589fb3658df8cb7cce8505cf821e40
+8d7588b06f81ef23bea8d84442af8e68
diff --git a/debian/patches/series b/debian/patches/series
index aba5430..3d5c5c8 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -26,10 +26,10 @@ maxhostnamelen.patch
 conch-ssh-rsa.patch
 systemd-socket-activation.patch
 broken-zero-call-used-regs.patch
-socket-activation-documentation.patch
 test-set-UsePAM-no-on-some-tests.patch
 auth-Add-KbdintResult-definition-to-define-result-values-.patch
 auth-pam-Add-an-enum-to-define-the-PAM-done-status.patch
 auth-pam-Add-debugging-information-when-we-receive-PAM-me.patch
 auth-pam-Immediately-report-interactive-instructions-to-c.patch
 sshconnect2-Write-kbd-interactive-service-info-and-instru.patch
+sshd-socket-generator.patch
diff --git a/debian/patches/socket-activation-documentation.patch b/debian/patches/socket-activation-documentation.patch
deleted file mode 100644
index 9afde55..0000000
--- a/debian/patches/socket-activation-documentation.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-Index: openssh-9.0p1/sshd_config.5
-===================================================================
---- openssh-9.0p1.orig/sshd_config.5
-+++ openssh-9.0p1/sshd_config.5
-@@ -1069,6 +1069,15 @@
- Multiple
- .Cm ListenAddress
- options are permitted.
-+.Pp
-+.Cm Note:
-+On Ubuntu, the openssh-server package is configured to use systemd
-+socket-based activation by default.  Therefore if you are using systemd with
-+the default configuration,
-+.Cm ListenAddress
-+options will not be honored.  Address configuration must be handled in
-+.Pa /etc/systemd/system/ssh.socket.d
-+instead.
- .It Cm LoginGraceTime
- The server disconnects after this time if the user has not
- successfully logged in.
-@@ -1520,6 +1529,15 @@
- Multiple options of this type are permitted.
- See also
- .Cm ListenAddress .
-+.Pp
-+.Cm Note:
-+On Ubuntu, the openssh-server package is configured to use systemd
-+socket-based activation by default.  Therefore if you are using systemd with
-+the default configuration,
-+.Cm Port
-+options will not be honored.  Address configuration must be handled in
-+.Pa /etc/systemd/system/ssh.socket.d
-+instead.
- .It Cm PrintLastLog
- Specifies whether
- .Xr sshd 8
-Index: openssh-9.0p1/sshd_config
-===================================================================
---- openssh-9.0p1.orig/sshd_config
-+++ openssh-9.0p1/sshd_config
-@@ -12,6 +12,9 @@
- 
- Include /etc/ssh/sshd_config.d/*.conf
- 
-+# Port and ListenAddress options are not used when sshd is socket-activated,
-+# which is now the default in Ubuntu.  See sshd_config(5) and
-+# /usr/share/doc/openssh-server/README.Debian.gz for details.
- #Port 22
- #AddressFamily any
- #ListenAddress 0.0.0.0
diff --git a/debian/patches/sshd-socket-generator.patch b/debian/patches/sshd-socket-generator.patch
new file mode 100644
index 0000000..ae3692c
--- /dev/null
+++ b/debian/patches/sshd-socket-generator.patch
@@ -0,0 +1,363 @@
+--- /dev/null
++++ b/sshd-socket-generator.c
+@@ -0,0 +1,290 @@
++#include <errno.h>
++#include <linux/limits.h>
++#include <netdb.h>
++#include <stdbool.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++#include <sys/socket.h>
++#include <sys/stat.h>
++#include <sys/types.h>
++
++#include "includes.h"
++
++#include "hostfile.h"   /* Needs to be included before auth.h */
++#include "auth.h"
++#include "kex.h"
++#include "log.h"
++#include "misc.h"
++#include "monitor.h"
++#include "ssh-gss.h"    /* Needs to be included before monitor_wrap.h */
++#include "monitor_wrap.h"
++#include "pathnames.h"
++#include "servconf.h"
++#include "sshbuf.h"
++
++#define MAX_LISTEN_STREAMS      (16)
++#define MAX_LISTEN_STREAM_LEN   (NI_MAXHOST + NI_MAXSERV + sizeof("ListenAddress=[:]") + 1)
++typedef char listen_stream_set[MAX_LISTEN_STREAMS][MAX_LISTEN_STREAM_LEN];
++
++/* Global variables required for sshd config parsing. */
++ServerOptions options = {};
++struct sshbuf *cfg = NULL;
++struct include_list includes = TAILQ_HEAD_INITIALIZER(includes);
++
++/* Other global variables that are required for this to build, because of their
++ * use throughout the codebase. We do NOT use these variables for the
++ * generator. */
++Authctxt *the_authctxt = NULL;
++int privsep_is_preauth = 1;
++int use_privsep = -1;
++struct monitor *pmonitor = NULL;
++struct ssh *the_active_state = NULL;
++struct sshauthopt *auth_opts = NULL;
++struct sshbuf *loginmsg = NULL;
++
++static int listen_stream_set_append(listen_stream_set set, const char *listen_stream) {
++        size_t n;
++
++        if (!set)
++                return -EINVAL;
++
++        n = strnlen(listen_stream, MAX_LISTEN_STREAM_LEN);
++        if (n == MAX_LISTEN_STREAM_LEN)
++                return -EINVAL;
++
++        for (int i = 0; i < MAX_LISTEN_STREAMS; i++) {
++                if (strcmp(set[i], listen_stream) == 0)
++                        return 0;
++
++                if (strnlen(set[i], MAX_LISTEN_STREAM_LEN) > 0)
++                        continue;
++
++                memcpy(set[i], listen_stream, n);
++
++                return 0;
++        }
++
++        return -E2BIG;
++}
++
++static int listen_stream_set_len(listen_stream_set set) {
++        int r = 0;
++
++        if (!set)
++                return 0;
++
++        for (int i = 0; i < MAX_LISTEN_STREAMS; i++) {
++                if (strnlen(set[i], MAX_LISTEN_STREAM_LEN) > 0)
++                        r++;
++                else
++                        break;
++        }
++
++        return r;
++}
++
++static char *path_append(const char *base, const char *append) {
++        bool add_slash;
++        size_t n = 0, len_base, len_append;
++        char *path = NULL;
++
++        len_base = strnlen(base, PATH_MAX);
++        len_append = strnlen(append, PATH_MAX);
++        add_slash = base[len_base - 1] != '/';
++
++        path = calloc(len_base + len_append + (add_slash ? 2 : 1), sizeof(char));
++        if (!path)
++                return NULL;
++
++        memcpy(path, base, len_base);
++        n += len_base;
++
++        if (add_slash)
++                path[n++] = '/';
++
++        memcpy(path + n, append, len_append);
++        n += len_append;
++        path[n] = '\0';
++
++        return path;
++}
++
++static int fflush_and_check(FILE *f) {
++        errno = 0;
++        fflush(f);
++
++        if (ferror(f))
++                return errno > 0 ? -errno : -EIO;
++
++        return 0;
++}
++
++static int write_systemd_socket_file(const char *destdir) {
++        listen_stream_set listen_streams = {};
++        int num_listen_streams;
++        char *conf = NULL, *overridedir = NULL;
++        FILE *f = NULL;
++        int r;
++
++        overridedir = path_append(destdir, "ssh.socket.d");
++        if (!overridedir) {
++                r = -ENOMEM;
++                goto out;
++        }
++
++        if (mkdir(overridedir, 0755) < 0 && errno != EEXIST) {
++                r = -errno;
++                goto out;
++        }
++
++        conf = path_append(overridedir, "addresses.conf");
++        if (!conf) {
++                r = -ENOMEM;
++                goto out;
++        }
++
++        f = fopen(conf, "we");
++        if (!f) {
++                r = -errno;
++                goto out;
++        }
++
++        fprintf(f,
++                "# Automatically generated by sshd-socket-generator\n"
++                "\n[Socket]\n"
++                "ListenStream=\n");
++
++        for (u_int i = 0; i < options.num_listen_addrs; i++) {
++                for (struct addrinfo *ai = options.listen_addrs[i].addrs; ai; ai = ai->ai_next) {
++                        char addr[NI_MAXHOST] = {}, port[NI_MAXSERV] = {},
++                             listen_stream[MAX_LISTEN_STREAM_LEN] = {};
++
++                        r = getnameinfo(ai->ai_addr, ai->ai_addrlen,
++                                        addr, sizeof(addr),
++                                        port, sizeof(port),
++                                        NI_NUMERICHOST|NI_NUMERICSERV);
++                        if (r != 0) {
++                                fprintf(stderr, "%s\n", gai_strerror(r));
++                                r = r == EAI_SYSTEM ? -errno : -EINVAL;
++                                goto out;
++                        }
++
++                        if (strcmp(addr, "0.0.0.0") == 0 || strcmp(addr, "::") == 0) {
++                                if (strcmp(port, "22") == 0)
++                                        /* No need to override. This is the
++                                         * default in ssh.socket. */
++                                        continue;
++
++                                /* If ListenAddress is 0.0.0.0 or ::, only
++                                 * write the port in ListenStream=. */
++                                snprintf(listen_stream,
++                                        MAX_LISTEN_STREAM_LEN,
++                                        "ListenStream=%s",
++                                        port);
++                        } else
++                                snprintf(listen_stream,
++                                        MAX_LISTEN_STREAM_LEN,
++                                        "ListenStream=%s%s%s:%s",
++                                        ai->ai_family == AF_INET6 ? "[" : "",
++                                        addr,
++                                        ai->ai_family == AF_INET6 ? "]" : "",
++                                        port);
++
++                        r = listen_stream_set_append(listen_streams, listen_stream);
++                        if (r < 0)
++                                goto out;
++                }
++        }
++
++        num_listen_streams = listen_stream_set_len(listen_streams);
++
++        if (num_listen_streams <= 0) {
++                /* We didn't generate anything useful, so clean up and leave
++                 * ssh.socket as-is. */
++                r = -ENODATA;
++                goto out;
++        }
++
++        for (int i = 0; i < num_listen_streams; i++)
++                fprintf(f, "%s\n", listen_streams[i]);
++
++        r = fflush_and_check(f);
++        if (r < 0)
++                goto out;
++
++out:
++        if (f)
++                fclose(f);
++
++        if (r < 0) {
++                (void) remove(conf);
++                (void) remove(overridedir);
++        }
++
++        free(overridedir);
++        free(conf);
++
++        return r;
++}
++
++static int parse_sshd_config_options() {
++        struct connection_info *connection_info;
++
++        cfg = sshbuf_new();
++        if (!cfg)
++                return -ENOMEM;
++
++	initialize_server_options(&options);
++        load_server_config(_PATH_SERVER_CONFIG_FILE, cfg);
++        parse_server_config(&options, _PATH_SERVER_CONFIG_FILE, cfg, &includes, NULL, 0);
++        fill_default_server_options(&options);
++
++        connection_info = get_connection_info(NULL, 0, 0);
++        connection_info->test = 1;
++
++        parse_server_match_config(&options, &includes, connection_info);
++
++        return 0;
++}
++
++int main(int argc, char **argv) {
++        const char *destdir = NULL;
++        int r;
++
++        if (argc < 2) {
++                fprintf(stderr, "Expected at least one argument.\n");
++
++                return EXIT_FAILURE;
++        }
++
++        destdir = argv[1];
++
++        r = parse_sshd_config_options();
++        if (r < 0) {
++                fprintf(stderr, "Faild to parse sshd config: %s\n", strerror(-r));
++
++                return EXIT_FAILURE;
++        }
++
++        if (options.num_listen_addrs <= 0) {
++                /* No listen addresses configured? Don't generate anything. */
++                fprintf(stderr, "No listen addresses configured. Will not generate anything.\n");
++
++                return EXIT_SUCCESS;
++        }
++
++        r = write_systemd_socket_file(destdir);
++        if (r == -ENODATA) {
++                fprintf(stderr, "No custom listen addresses configured. Will not generated anything.\n");
++
++                return EXIT_SUCCESS;
++        }
++        if (r < 0) {
++                fprintf(stderr, "Failed to generate ssh.socket: %s\n", strerror(-r));
++
++                return EXIT_FAILURE;
++        }
++
++        return EXIT_SUCCESS;
++}
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -17,6 +17,7 @@
+ top_srcdir=@top_srcdir@
+ abs_top_srcdir=@abs_top_srcdir@
+ abs_top_builddir=@abs_top_builddir@
++systemd_system_generator_dir=$(shell pkg-config --variable=systemd_system_generator_dir systemd)
+ 
+ DESTDIR=
+ VPATH=@srcdir@
+@@ -69,7 +70,7 @@
+ 
+ .SUFFIXES: .lo
+ 
+-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT)
++TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) sshd-socket-generator$(EXEEXT)
+ 
+ XMSS_OBJS=\
+ 	ssh-xmss.o \
+@@ -134,6 +135,16 @@
+ 	sandbox-seccomp-filter.o sandbox-capsicum.o sandbox-pledge.o \
+ 	sandbox-solaris.o uidswap.o $(SKOBJS)
+ 
++SSHD_SOCKET_GEN_OBJS=sshd-socket-generator.o \
++	platform.o servconf.o groupaccess.o audit.o audit-linux.o \
++	auth2.o auth2-none.o auth2-gss.o \
++	auth2-passwd.o auth2-kbdint.o auth2-hostbased.o \
++	auth-options.o uidswap.o auth2-pubkey.o auth.o \
++	auth2-pubkeyfile.o auth-rhosts.o auth-passwd.o \
++	gss-serv.o auth2-chall.o auth-pam.o gss-serv-krb5.o \
++	loginrec.o auth-krb5.o auth-shadow.o \
++	monitor.o monitor_wrap.o
++
+ SFTP_CLIENT_OBJS=sftp-common.o sftp-client.o sftp-glob.o
+ 
+ SCP_OBJS=	scp.o progressmeter.o $(SFTP_CLIENT_OBJS)
+@@ -210,6 +221,9 @@
+ sshd$(EXEEXT): libssh.a	$(LIBCOMPAT) $(SSHDOBJS)
+ 	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS) $(CHANNELLIBS)
+ 
++sshd-socket-generator$(EXEEXT): libssh.a $(LIBCOMPAT) $(SSHD_SOCKET_GEN_OBJS)
++	$(LD) -o $@ $(SSHD_SOCKET_GEN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS) $(CHANNELLIBS)
++
+ scp$(EXEEXT): $(LIBCOMPAT) libssh.a $(SCP_OBJS)
+ 	$(LD) -o $@ $(SCP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+ 
+@@ -392,6 +406,7 @@
+ 	$(MKDIR_P) $(DESTDIR)$(mandir)/$(mansubdir)5
+ 	$(MKDIR_P) $(DESTDIR)$(mandir)/$(mansubdir)8
+ 	$(MKDIR_P) $(DESTDIR)$(libexecdir)
++	$(MKDIR_P) $(DESTDIR)$(systemd_system_generator_dir)
+ 	$(MKDIR_P) -m 0755 $(DESTDIR)$(PRIVSEP_PATH)
+ 	$(INSTALL) -m 0755 $(STRIP_OPT) ssh$(EXEEXT) $(DESTDIR)$(bindir)/ssh$(EXEEXT)
+ 	$(INSTALL) -m 0755 $(STRIP_OPT) scp$(EXEEXT) $(DESTDIR)$(bindir)/scp$(EXEEXT)
+@@ -421,6 +436,7 @@
+ 	$(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
+ 	$(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
+ 	$(INSTALL) -m 644 ssh-sk-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-sk-helper.8
++	$(INSTALL) -m 0755 $(STRIP_OPT) sshd-socket-generator$(EXEEXT) $(DESTDIR)$(systemd_system_generator_dir)/sshd-socket-generator$(EXEEXT)
+ 
+ install-sysconf:
+ 	$(MKDIR_P) $(DESTDIR)$(sysconfdir)
+@@ -478,6 +494,7 @@
+ 	-rm -f $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT)
+ 	-rm -f $(DESTDIR)$(bindir)/sftp$(EXEEXT)
+ 	-rm -f $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
++	-rm -f $(DESTDIR)$(systemd_system_generator_dir)/sshd-socket-generator$(EXEEXT)
+ 	-rm -r $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
+ 	-rm -f $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
+ 	-rm -f $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
diff --git a/debian/po/cs.po b/debian/po/cs.po
index 21b4c7b..d01e0ff 100644
--- a/debian/po/cs.po
+++ b/debian/po/cs.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh 1:6.6p1-1\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2022-09-23 19:34+0000\n"
+"POT-Creation-Date: 2014-03-20 02:06+0000\n"
 "PO-Revision-Date: 2014-06-12 12:25+0200\n"
 "Last-Translator: Michal Simunek <[e-mail]>\n"
 "Language-Team: Czech <[e-mail]>\n"
@@ -53,28 +53,3 @@ msgstr ""
 "poškodit systémy, které jsou nastaveny s předpokladem, že bude možné se "
 "přihlašovat přes SSH jako root pomocí ověřování heslem. Změnu této volby "
 "byste měli provést pouze pokud ověřování heslem potřebujete."
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid "Not migrating to socket activation"
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"This version of openssh-server uses socket-based activation by default. "
-"However, because you have more than one ListenAddress configured in "
-"sshd_config, it is impossible to determine at upgrade time if migrating you "
-"to socket-based activation would cause the starting of sshd at boot to be "
-"unreliable."
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"Because a failure to start ssh may make it impossible to admininister a "
-"system, you will not be migrated to socket-based activation at this time."
-msgstr ""
diff --git a/debian/po/da.po b/debian/po/da.po
index a08ca3b..70d576d 100644
--- a/debian/po/da.po
+++ b/debian/po/da.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2022-09-23 19:34+0000\n"
+"POT-Creation-Date: 2014-03-20 02:06+0000\n"
 "PO-Revision-Date: 2014-03-21 23:51+0200\n"
 "Last-Translator: Joe Hansen <[e-mail]>\n"
 "Language-Team: Danish <[e-mail]>\n"
@@ -53,28 +53,3 @@ msgstr ""
 "Det kan dog ødelægge systemer, som er opsat med forventning om at kunne SSH "
 "som root via brug af adgangskodegodkendelse. Du skal kun lave denne ændring, "
 "hvis du ikke har brug for dette."
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid "Not migrating to socket activation"
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"This version of openssh-server uses socket-based activation by default. "
-"However, because you have more than one ListenAddress configured in "
-"sshd_config, it is impossible to determine at upgrade time if migrating you "
-"to socket-based activation would cause the starting of sshd at boot to be "
-"unreliable."
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"Because a failure to start ssh may make it impossible to admininister a "
-"system, you will not be migrated to socket-based activation at this time."
-msgstr ""
diff --git a/debian/po/de.po b/debian/po/de.po
index 2536ea4..ecba54b 100644
--- a/debian/po/de.po
+++ b/debian/po/de.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh_1:6.6p1-1\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2022-09-23 19:34+0000\n"
+"POT-Creation-Date: 2014-03-20 02:06+0000\n"
 "PO-Revision-Date: 2014-03-24 22:21+0100\n"
 "Last-Translator: Stephan Beck <[e-mail]>\n"
 "Language-Team: Debian German translation team <debian-l10n-german@lists."
@@ -59,28 +59,3 @@ msgstr ""
 "in der Absicht konfiguriert wurden, die Anmeldung als »root« über SSH unter "
 "Verwendung von Passwort-Authentifizierung zuzulassen. Sie sollten diese "
 "Änderung nur vornehmen, wenn Sie auf Letzteres verzichten können."
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid "Not migrating to socket activation"
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"This version of openssh-server uses socket-based activation by default. "
-"However, because you have more than one ListenAddress configured in "
-"sshd_config, it is impossible to determine at upgrade time if migrating you "
-"to socket-based activation would cause the starting of sshd at boot to be "
-"unreliable."
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"Because a failure to start ssh may make it impossible to admininister a "
-"system, you will not be migrated to socket-based activation at this time."
-msgstr ""
diff --git a/debian/po/es.po b/debian/po/es.po
index 14550d6..de8a67a 100644
--- a/debian/po/es.po
+++ b/debian/po/es.po
@@ -28,7 +28,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2022-09-23 19:34+0000\n"
+"POT-Creation-Date: 2014-03-20 02:06+0000\n"
 "PO-Revision-Date: 2014-03-23 20:43-0300\n"
 "Last-Translator: Matías Bellone <[e-mail]>\n"
 "Language-Team: Debian l10n Spanish <[e-mail]>\n"
@@ -78,28 +78,3 @@ msgstr ""
 "configuración permite que el usuario root inicie sesión a través de SSH "
 "utilizando una contraseña. Sólo debería realizar este cambio si no necesita "
 "este comportamiento."
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid "Not migrating to socket activation"
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"This version of openssh-server uses socket-based activation by default. "
-"However, because you have more than one ListenAddress configured in "
-"sshd_config, it is impossible to determine at upgrade time if migrating you "
-"to socket-based activation would cause the starting of sshd at boot to be "
-"unreliable."
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"Because a failure to start ssh may make it impossible to admininister a "
-"system, you will not be migrated to socket-based activation at this time."
-msgstr ""
diff --git a/debian/po/fr.po b/debian/po/fr.po
index 7d7093b..f7125e9 100644
--- a/debian/po/fr.po
+++ b/debian/po/fr.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh_1:6.5p1-6\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2022-09-23 19:34+0000\n"
+"POT-Creation-Date: 2014-03-20 02:06+0000\n"
 "PO-Revision-Date: 2014-03-22 08:26+0100\n"
 "Last-Translator: Étienne Gilli <[e-mail]>\n"
 "Language-Team: French <[e-mail]>\n"
@@ -57,28 +57,3 @@ msgstr ""
 "inutilisables les systèmes reposant sur la possibilité de se connecter au "
 "compte « root » par SSH avec authentification par mot de passe. Vous ne "
 "devriez appliquer cette modification que si ce n’est pas votre cas."
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid "Not migrating to socket activation"
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"This version of openssh-server uses socket-based activation by default. "
-"However, because you have more than one ListenAddress configured in "
-"sshd_config, it is impossible to determine at upgrade time if migrating you "
-"to socket-based activation would cause the starting of sshd at boot to be "
-"unreliable."
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"Because a failure to start ssh may make it impossible to admininister a "
-"system, you will not be migrated to socket-based activation at this time."
-msgstr ""
diff --git a/debian/po/it.po b/debian/po/it.po
index 5390795..dd71060 100644
--- a/debian/po/it.po
+++ b/debian/po/it.po
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2022-09-23 19:34+0000\n"
+"POT-Creation-Date: 2014-03-20 02:06+0000\n"
 "PO-Revision-Date: 2014-03-28 11:12+0200\n"
 "Last-Translator: Beatrice Torracca <[e-mail]>\n"
 "Language-Team: Italian <[e-mail]>\n"
@@ -56,28 +56,3 @@ msgstr ""
 "impostati facendo affidamento sulla possibilità di autenticazione SSH come "
 "root usando la password. Si dovrebbe fare questo cambiamento solo se non si "
 "ha bisogno di tale comportamento."
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid "Not migrating to socket activation"
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"This version of openssh-server uses socket-based activation by default. "
-"However, because you have more than one ListenAddress configured in "
-"sshd_config, it is impossible to determine at upgrade time if migrating you "
-"to socket-based activation would cause the starting of sshd at boot to be "
-"unreliable."
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"Because a failure to start ssh may make it impossible to admininister a "
-"system, you will not be migrated to socket-based activation at this time."
-msgstr ""
diff --git a/debian/po/ja.po b/debian/po/ja.po
index b48d281..db382f1 100644
--- a/debian/po/ja.po
+++ b/debian/po/ja.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2022-09-23 19:34+0000\n"
+"POT-Creation-Date: 2014-03-20 02:06+0000\n"
 "PO-Revision-Date: 2014-03-20 11:06+0900\n"
 "Last-Translator: victory <[e-mail]>\n"
 "Language-Team: Japanese <[e-mail]>\n"
@@ -53,28 +53,3 @@ msgstr ""
 "ます。しかしパスワード認証により root で SSH 接続できることを前提として構成し"
 "たシステムでは問題が発生する可能性があります。そういった必要のない場合にのみ"
 "この変更を行うようにしてください。"
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid "Not migrating to socket activation"
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"This version of openssh-server uses socket-based activation by default. "
-"However, because you have more than one ListenAddress configured in "
-"sshd_config, it is impossible to determine at upgrade time if migrating you "
-"to socket-based activation would cause the starting of sshd at boot to be "
-"unreliable."
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"Because a failure to start ssh may make it impossible to admininister a "
-"system, you will not be migrated to socket-based activation at this time."
-msgstr ""
diff --git a/debian/po/nl.po b/debian/po/nl.po
index eca9662..3afd617 100644
--- a/debian/po/nl.po
+++ b/debian/po/nl.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2022-09-23 19:34+0000\n"
+"POT-Creation-Date: 2014-03-20 02:06+0000\n"
 "PO-Revision-Date: 2014-10-03 23:54+0200\n"
 "Last-Translator: Frans Spiesschaert <[e-mail]>\n"
 "Language-Team: Debian Dutch l10n Team <[e-mail]>\n"
@@ -58,28 +58,3 @@ msgstr ""
 "ingesteld werden vanuit de verwachting dat de systeembeheerder SSH kan "
 "gebruiken met authenticatie via wachtwoord. Enkel wanneer u dit laatste niet "
 "nodig heeft, zou u deze wijziging kunnen doorvoeren."
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid "Not migrating to socket activation"
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"This version of openssh-server uses socket-based activation by default. "
-"However, because you have more than one ListenAddress configured in "
-"sshd_config, it is impossible to determine at upgrade time if migrating you "
-"to socket-based activation would cause the starting of sshd at boot to be "
-"unreliable."
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"Because a failure to start ssh may make it impossible to admininister a "
-"system, you will not be migrated to socket-based activation at this time."
-msgstr ""
diff --git a/debian/po/pt.po b/debian/po/pt.po
index 8f51af9..2dab84c 100644
--- a/debian/po/pt.po
+++ b/debian/po/pt.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh 1:6.6p1-1\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2022-09-23 19:34+0000\n"
+"POT-Creation-Date: 2014-03-20 02:06+0000\n"
 "PO-Revision-Date: 2014-03-21 21:13+0000\n"
 "Last-Translator: Américo Monteiro <[e-mail]>\n"
 "Language-Team: Portuguese <[e-mail]>\n"
@@ -57,28 +57,3 @@ msgstr ""
 "configurados com a expectativa de serem capazes de SSH como root usando "
 "autenticação por palavra-passe. Apenas deverá fazer esta alteração se não "
 "precisa de tal método de autenticação."
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid "Not migrating to socket activation"
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"This version of openssh-server uses socket-based activation by default. "
-"However, because you have more than one ListenAddress configured in "
-"sshd_config, it is impossible to determine at upgrade time if migrating you "
-"to socket-based activation would cause the starting of sshd at boot to be "
-"unreliable."
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"Because a failure to start ssh may make it impossible to admininister a "
-"system, you will not be migrated to socket-based activation at this time."
-msgstr ""
diff --git a/debian/po/pt_BR.po b/debian/po/pt_BR.po
index 98856bb..99b1182 100644
--- a/debian/po/pt_BR.po
+++ b/debian/po/pt_BR.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2022-09-23 19:34+0000\n"
+"POT-Creation-Date: 2014-03-20 02:06+0000\n"
 "PO-Revision-Date: 2014-11-23 23:49-0200\n"
 "Last-Translator: José de Figueiredo <[e-mail]>\n"
 "Language-Team: Brazilian Portuguese <[e-mail]."
@@ -55,28 +55,3 @@ msgstr ""
 "Entretanto, ela pode quebrar sistemas que foram configurados com a "
 "expectativa de acesso SSH com root usando autenticação por senha. Você deve "
 "fazer esta mudança somente se você não precisa fazer isso."
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid "Not migrating to socket activation"
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"This version of openssh-server uses socket-based activation by default. "
-"However, because you have more than one ListenAddress configured in "
-"sshd_config, it is impossible to determine at upgrade time if migrating you "
-"to socket-based activation would cause the starting of sshd at boot to be "
-"unreliable."
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"Because a failure to start ssh may make it impossible to admininister a "
-"system, you will not be migrated to socket-based activation at this time."
-msgstr ""
diff --git a/debian/po/ru.po b/debian/po/ru.po
index 3fa193c..f2e1daf 100644
--- a/debian/po/ru.po
+++ b/debian/po/ru.po
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh 1:6.6p1-1\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2022-09-23 19:34+0000\n"
+"POT-Creation-Date: 2014-03-20 02:06+0000\n"
 "PO-Revision-Date: 2014-03-22 10:04+0400\n"
 "Last-Translator: Yuri Kozlov <[e-mail]>\n"
 "Language-Team: Russian <[e-mail]>\n"
@@ -14,8 +14,8 @@ msgstr ""
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && "
-"n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n"
+"Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n"
+"%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n"
 "X-Generator: Lokalize 1.4\n"
 
 #. Type: boolean
@@ -55,28 +55,3 @@ msgstr ""
 "атак). Однако, это вредит системам, в которых специально настроен вход для "
 "root по SSH с парольной аутентификацией. Если это не ваш случай, то ответьте "
 "утвердительно."
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid "Not migrating to socket activation"
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"This version of openssh-server uses socket-based activation by default. "
-"However, because you have more than one ListenAddress configured in "
-"sshd_config, it is impossible to determine at upgrade time if migrating you "
-"to socket-based activation would cause the starting of sshd at boot to be "
-"unreliable."
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"Because a failure to start ssh may make it impossible to admininister a "
-"system, you will not be migrated to socket-based activation at this time."
-msgstr ""
diff --git a/debian/po/sv.po b/debian/po/sv.po
index 296e611..278b0cc 100644
--- a/debian/po/sv.po
+++ b/debian/po/sv.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2022-09-23 19:34+0000\n"
+"POT-Creation-Date: 2014-03-20 02:06+0000\n"
 "PO-Revision-Date: 2014-03-21 21:36+0100\n"
 "Last-Translator: Andreas Rönnquist <[e-mail]>\n"
 "Language-Team: Swedish\n"
@@ -56,28 +56,3 @@ msgstr ""
 "sådana angrepp). Dock så kan detta förstöra system som förväntas kunna "
 "använda SSH som root med hjälp av lösenordsautentisering. Du skall endast "
 "göra denna förändring om du inte har ett behov av att kunna göra detta."
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid "Not migrating to socket activation"
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"This version of openssh-server uses socket-based activation by default. "
-"However, because you have more than one ListenAddress configured in "
-"sshd_config, it is impossible to determine at upgrade time if migrating you "
-"to socket-based activation would cause the starting of sshd at boot to be "
-"unreliable."
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"Because a failure to start ssh may make it impossible to admininister a "
-"system, you will not be migrated to socket-based activation at this time."
-msgstr ""
diff --git a/debian/po/templates.pot b/debian/po/templates.pot
index c9dc5ba..47c9e36 100644
--- a/debian/po/templates.pot
+++ b/debian/po/templates.pot
@@ -1,6 +1,6 @@
 # SOME DESCRIPTIVE TITLE.
 # Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
-# This file is distributed under the same license as the openssh package.
+# This file is distributed under the same license as the PACKAGE package.
 # FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
 #
 #, fuzzy
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2022-09-23 19:34+0000\n"
+"POT-Creation-Date: 2014-03-20 02:06+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <[e-mail]>\n"
@@ -44,28 +44,3 @@ msgid ""
 "able to SSH as root using password authentication. You should only make this "
 "change if you do not need to do that."
 msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid "Not migrating to socket activation"
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"This version of openssh-server uses socket-based activation by default. "
-"However, because you have more than one ListenAddress configured in "
-"sshd_config, it is impossible to determine at upgrade time if migrating you "
-"to socket-based activation would cause the starting of sshd at boot to be "
-"unreliable."
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"Because a failure to start ssh may make it impossible to admininister a "
-"system, you will not be migrated to socket-based activation at this time."
-msgstr ""
diff --git a/debian/po/tr.po b/debian/po/tr.po
index fd6bde5..1ada041 100644
--- a/debian/po/tr.po
+++ b/debian/po/tr.po
@@ -7,15 +7,15 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh-server\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2022-09-23 19:34+0000\n"
+"POT-Creation-Date: 2014-03-20 02:06+0000\n"
 "PO-Revision-Date: 2014-08-01 14:44+0200\n"
 "Last-Translator: Mert Dirik <[e-mail]>\n"
 "Language-Team: Debian L10n Turkish <[e-mail]>\n"
-"Language: tr\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "X-Generator: Poedit 1.5.4\n"
+"Language: tr\n"
 
 #. Type: boolean
 #. Description
@@ -56,28 +56,3 @@ msgstr ""
 "parola doğrulama yöntemiyle oturum açılabileceği varsayımıyla hareket eden "
 "sistemlerde eskiden çalışan düzenin bozulmasına sebep olacaktır. Bu "
 "değişikliği yalnızca sorun çıkarmayacağından eminseniz yapın."
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid "Not migrating to socket activation"
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"This version of openssh-server uses socket-based activation by default. "
-"However, because you have more than one ListenAddress configured in "
-"sshd_config, it is impossible to determine at upgrade time if migrating you "
-"to socket-based activation would cause the starting of sshd at boot to be "
-"unreliable."
-msgstr ""
-
-#. Type: error
-#. Description
-#: ../openssh-server.templates:3001
-msgid ""
-"Because a failure to start ssh may make it impossible to admininister a "
-"system, you will not be migrated to socket-based activation at this time."
-msgstr ""
diff --git a/debian/rules b/debian/rules
index dff4713..54d82cb 100755
--- a/debian/rules
+++ b/debian/rules
@@ -1,6 +1,6 @@
 #!/usr/bin/make -f
 
-export DEB_BUILD_MAINT_OPTIONS := hardening=+all
+export DEB_BUILD_MAINT_OPTIONS := hardening=+all optimize=+lto
 
 include /usr/share/dpkg/default.mk
 
diff --git a/debian/systemd/ssh.socket b/debian/systemd/ssh.socket
index 1de1280..69e93a0 100644
--- a/debian/systemd/ssh.socket
+++ b/debian/systemd/ssh.socket
@@ -1,11 +1,13 @@
 [Unit]
 Description=OpenBSD Secure Shell server socket
-Before=sockets.target
+Before=sockets.target ssh.service
 ConditionPathExists=!/etc/ssh/sshd_not_to_be_run
 
 [Socket]
 ListenStream=22
 Accept=no
+FreeBind=yes
 
 [Install]
 WantedBy=sockets.target
+RequiredBy=ssh.service
diff --git a/debian/tests/control b/debian/tests/control
index adef04c..dd8069d 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -15,3 +15,9 @@ Restrictions: needs-root allow-stderr
 Depends: openssh-client,
          openssh-server,
          systemd,
+
+Tests: sshd-socket-generator
+Restrictions: needs-root allow-stderr
+Depends: openssh-client,
+         openssh-server,
+         systemd,
diff --git a/debian/tests/sshd-socket-generator b/debian/tests/sshd-socket-generator
new file mode 100644
index 0000000..da6b4d6
--- /dev/null
+++ b/debian/tests/sshd-socket-generator
@@ -0,0 +1,105 @@
+#!/bin/bash
+
+test_default() (
+    set -xeuo pipefail
+
+    /usr/lib/systemd/system-generators/sshd-socket-generator "$testdir"
+
+    # Nothing should be generated in this case.
+    test ! -e "$testdir/ssh.socket.d"
+)
+
+test_custom_port() (
+    set -xeuo pipefail
+
+    echo "Port 1234" >> "$testconf"
+
+    /usr/lib/systemd/system-generators/sshd-socket-generator "$testdir"
+
+    grep -q "^ListenStream=1234" "$socket_override"
+)
+
+test_mutiple_custom_ports() (
+    set -xeuo pipefail
+
+    echo "Port 1234" >> "$testconf"
+    echo "Port 4321" >> "$testconf"
+
+    /usr/lib/systemd/system-generators/sshd-socket-generator "$testdir"
+
+    grep -q "^ListenStream=1234" "$socket_override"
+    grep -q "^ListenStream=4321" "$socket_override"
+)
+
+test_custom_listenaddress() (
+    set -xeuo pipefail
+
+    echo "ListenAddress 10.1.2.3" >> "$testconf"
+
+    /usr/lib/systemd/system-generators/sshd-socket-generator "$testdir"
+
+    grep -q "^ListenStream=10.1.2.3:22" "$socket_override"
+)
+
+test_custom_listenaddress_and_port() (
+    set -xeuo pipefail
+
+    echo "Port 1234" >> "$testconf"
+    echo "ListenAddress 10.1.2.3" >> "$testconf"
+
+    /usr/lib/systemd/system-generators/sshd-socket-generator "$testdir"
+
+    grep -q "^ListenStream=10.1.2.3:1234" "$socket_override"
+)
+
+test_custom_ipv6_listenaddress() (
+    set -xeuo pipefail
+
+    echo "ListenAddress 2001:db8:85a3::8a2e:370:7334" >> "$testconf"
+
+    /usr/lib/systemd/system-generators/sshd-socket-generator "$testdir"
+
+    grep -q "^ListenStream=\[2001:db8:85a3::8a2e:370:7334\]:22" "$socket_override"
+)
+
+tmpdir="$(mktemp -d)"
+testconf="/etc/ssh/sshd_config.d/test.conf"
+failed=
+
+mkdir -p /etc/ssh/sshd_config.d
+
+for test_fn in \
+    "test_default" \
+    "test_custom_port" \
+    "test_mutiple_custom_ports" \
+    "test_custom_listenaddress" \
+    "test_custom_listenaddress_and_port" \
+    "test_custom_ipv6_listenaddress"
+do
+    echo -n "$test_fn..."
+
+    testdir="${tmpdir}/${test_fn}"
+    socket_override="${testdir}/ssh.socket.d/addresses.conf"
+    mkdir -p "$testdir"
+
+    $test_fn > "${AUTOPKGTEST_ARTIFACTS}/${test_fn}.log" 2>&1
+    if [[ $? -eq 0 ]]; then
+        echo "PASS"
+    else
+        echo "FAIL"
+        failed="${failed:+$failed }$test_fn"
+    fi
+
+    >"$testconf"
+done
+
+if [[ -n "$failed" ]]; then
+    for t in $failed; do
+        echo "--------------------------------------------"
+        echo "FAIL: $t"
+        echo "--------------------------------------------"
+        cat "${AUTOPKGTEST_ARTIFACTS}/${t}.log"
+    done
+
+    exit 1
+fi